s���qf�?m5���m~����G&m��Sv2�����^�B�!T6�pHEZ��U�/�[H-�vf"2���.ʇ�~��#� �a����v���z#�tj@�������=C +G@�l=��M:�$Q���Z\�4\���������!@�X�ݎP|@e�A��M���GG�� �zz�"���v'�Lo��,na�4��Ǵ��Q���zК$��f�J;0��=�S�aU6<O�̮R�K8�q���d!s�,������J���1]_j�_n{g���b�V�Q.8�Ѷ@�q�������k�qU�W�+L $�O?�ҞTn�H�\m���s��US�� ��U���={�,��2��g���B�l+�Z-���%�|؝��/�I�|�V�L���.�Nn'�h����u���s%��`�� _ֱ�0��V�Mx���Q��`�>� !pΉ��R��ea(�;q͎��~X�:��p*x���T��=�~v��z��u�^�Z�f���4����$�cׅX;���i#ڶ�W�Α��5��h=��aY�R�=������3x g�� �� �{���)���pՄz�����J}Lu�A��PP�Ch��^���]�KY�%�l�Z�~�,C�fi[Y�Q��?{)�W�՚�� ee�% ��W���.xl���ۤ��8�v ���9�b�]���aƏn�B���$�8��T�+`�����Ĺ��r/���"���tҠA��f!+}���mKE�����4��`�M��^[(�z@�����$i�xc;����a֠t�I^~#��cLF��w��,�Ⱥ�x�`���G�guκ�]-w'{p0s�$u�'l �B<&S��K����u��"����"���J���}4߯7��;6C�R��`g��lI6�Ԅh���@&�b�h��L�[�S@�"� ��| ���<6��V�1��YJ�;�Q-�-��#�z[�����b�?�@ͅ��y\ �6>,���S�u���Ɓ���^��d�\�r@Ke�f������J q�1Y�OAB�0�%C-/�X�SY�G_@�S�3'(����s)���V������;�`��s �{�h��(x����Os�MxA�_^].�n-���ی+C�P5� #�T�b�>(��Z� ��̪�x�蜪�?Q1�0�D2mR�K���q���{�V�/"�E�g�K�����>a [I琎I�O�W1%\�6 ݏ���k�Dc�S���|��>I��^�� ��B�3�K��WQ�|g�)�[�.�*`%5��p�v��T+�P�Y+��d�"��W�_� D�@��&c�+훨����|����o��b���:P)��� !�D�R�A`Z�Y�#�ΕDNN��2�2�UO�d�k"��?"�4tB�O 8}��R�o�lI(��l+ ����H��\�p��#�<zO��U��91|g �1�`�d��;�s�g�.�|����$J��0~�jz�;�5L�}٦�㓮�I���x�P�'����Շ�^�{v���+>d�Nk�U^�[�9mQ�a�{���]�]��˞�������|��n�B�*]���x1��v�/ֽr֢�����*�T��@U��vbX��T�^�G�r@*����NW�-�R�Z6j�����M��;iL Qgx����� �Ƨ�\�ArUM�kr�����m�j���Y����>a(|�&>����AX�&D��,�Ob��D.U�R�7Sa�zF�.���Ϗ��{�2�Կ���'��GVeZ�BϪe$g��5�A��)3ˤ��,֎:��/dMA9�w(�e����"YV��& �����O�C_p�+``�M !7�>abo�-9 ��C}v����@��j�B�y��TȊ:x�8��S�Á:`Т8��R_����4�u}���F�y�'k�]�����u� �W ���r����Z����e�g^��<����UB�N��T�7��A����$`��JO'�-�.Ք�U*��������)�����`��tȵ4k`��Y��������0{m�� ;Η�Kރ̃2�$n�ۆ����na���C5�CÏw�l�뎛�(���x ���@z ��� �g��b�����;C3 ��w���`\�fjl��d���8\⻤ux}�n��Q]G� <4|SC�-dGaz/.G-� �u���r�lJ`��ӼC`���� ���� }R}[�Cw�L�m�3y���9M*#'87SnV`�ဍ���(��G\&���gA���`�Ȱ�����Q�7^~JL��9��/�q�T��HxY�-��?�W%'8��j��v�U��J�Ί�S��bo�g�gF.O/@¡�\"5��Y\�/���ݯ&���8�c�����8@���ńI��ݞ��ڔ�"Z-���*524��S� S�[.����6ҤDČт#���J���*c�}�Լ�V����� �VJc��tV�X7�kAk�R��p�P�lb W4�7}��I��'RS�w^A�f���;VS,8��V�̫*�����ɟ��o���~X����Ǘ6�����-�A]�'�5;~++(��@���J9�9!�$������>E6P�!��o��0U;�el�{��8���ꈤfL�b������S=�ý�i3=K��UV0�녎[C�y�[�Ng���[�l��z�a(�O �H������Ej��\{�ģi!�'��':J��]��Ͽ��j��ѻ���9lk¡� L�;��ک���>�1=���ށt���V�;"����@M�@�"��%"f��oP H]Dy�`��R$=��u!�w� 4�=`q�5���;I:��Ց����"�g="3����H@��s���7��Մ���1Y�0'����饁\szS.(�ʜ�� m{�Tx!��n��n� ��>")�@���I(0�)�_Pإ`k����VG�ʱ���4�>x���h�r Qwc�U'v%S,����������������3Y�]�X��%;)�g���s/+��_6]��_Z�����fg���ت�&�](�+b���K� ]}����N�X䢝Ȃ3���{JȺi<,� �H�kU/G1�(��
Static task
static1
Behavioral task
behavioral1
Sample
Xrio-jMK8K2N0O5TV.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Xrio-jMK8K2N0O5TV.exe
Resource
win10v2004-20230220-en
General
-
Target
Xrio-jMK8K2N0O5TV.exe
-
Size
5.1MB
-
MD5
ad1fd5ab0dbdec742b9496a61a3bfe88
-
SHA1
233644dfcc6b91260b7717e7946552d950ecff49
-
SHA256
ddb3927ff96affaaf22f77d4b5fdcde3645743d9c1d8379d23246c9ac0537670
-
SHA512
8bd6a26da4fce036eb5c1fe2b8eb1bc9d52b87bc7dc213d6e639c1885993ed8f0f475546435bddd6e20138f2e7fb0459ddc784cfd758dfcde91ec3e349e903ab
-
SSDEEP
98304:eHFMDIwXLCx/OodwemRpq078mZMf8Oufo3eOu4LIq7kDzz1RNKSzc+wfCrO0vboi:eyDrXLCx/Ood5vM8mZMUOufo3euF7kD3
Malware Config
Signatures
Files
-
Xrio-jMK8K2N0O5TV.exe.exe windows x64
1b0d8d7387c60d322f7d736a6eeee5a4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegOpenKeyExA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
kernel32
GetFirmwareEnvironmentVariableW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowPos
CharUpperBuffW
gdi32
GetDeviceCaps
shell32
ShellExecuteExA
msvcp140
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
imm32
ImmSetCompositionWindow
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemory
ntdll
RtlLookupFunctionEntry
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-math-l1-1-0
ceil
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
normaliz
IdnToAscii
ws2_32
recvfrom
wldap32
ord301
crypt32
CertGetNameStringA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 760KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 209KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 500KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xrt0 Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xrt1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ